everything-claude-code

fix: nullish coalescing in evaluate-session config, narrow pre-compact glob, add 11 tests

- evaluate-session.js: || 10 → ?? 10 for min_session_length (0 is valid)
- pre-compact.js: *.tmp → *-session.tmp to match only session files
- 11 new tests: config loading (min=0, null, custom path, invalid JSON),
  session-end update path (timestamp, template replace, preserve content),
  pre-compact glob specificity, extractSessionSummary edge cases

Affaan Mustafa · 2026-02-13 02:42:01 -08:00

4ff4872bf3

fix: reject empty/invalid array commands in hooks validator, add 19 tests

validate-hooks.js: Empty arrays [] and arrays with non-string elements
(e.g., [123, null]) passed command validation due to JS truthiness of
empty arrays (![] === false). Added explicit length and element type
checks.

19 new tests covering: non-array event type values, null/string matcher
entries, string/number top-level data, empty string/array commands,
non-string array elements, non-string type field, non-number timeout,
timeout boundary (0), unwrapped hooks format, legacy format error paths,
empty agent directory, whitespace-only command files, valid skill refs,
mixed valid/invalid rules and skills.

Affaan Mustafa · 2026-02-13 02:33:40 -08:00

27dce7794a

fix: sanitize getExecCommand args, escape regex in getCommandPattern, clean up readStdinJson timeout, add 10 tests

Validate args parameter in getExecCommand() against SAFE_ARGS_REGEX to
prevent command injection when returned string is passed to a shell.
Escape regex metacharacters in getCommandPattern() generic action branch
to prevent malformed patterns and unintended matching. Clean up stdin
listeners in readStdinJson() timeout path to prevent process hanging.

Affaan Mustafa · 2026-02-13 02:27:04 -08:00

a62a3a2416

fix: eliminate command injection in hooks, fix pass-through newline corruption, add 8 tests

Replace shell: true with npx.cmd on Windows in post-edit-format.js and
post-edit-typecheck.js to prevent command injection via crafted file paths.
Replace console.log(data) with process.stdout.write(data) in
check-console-log.js to avoid appending extra newlines to pass-through data.

Affaan Mustafa · 2026-02-13 02:22:55 -08:00

d9331cb17f

fix: clamp getAllSessions pagination params, add cleanupAliases success field, add 10 tests

- session-manager: clamp offset/limit to safe non-negative integers to
  prevent negative offset counting from end and NaN returning empty results
- session-aliases: add success field to cleanupAliases return value for
  API contract consistency with setAlias/deleteAlias/renameAlias

Affaan Mustafa · 2026-02-13 02:16:22 -08:00

f33ed4c49e

fix: reject whitespace-only command/field values in CI validators, add 10 tests

validate-hooks.js: whitespace-only command strings now fail validation
validate-agents.js: whitespace-only model/tools values now fail validation

Affaan Mustafa · 2026-02-13 02:09:22 -08:00

2dbba8877b

fix: clamp progressBar to prevent RangeError on overflow, add 10 tests

progressBar() in skill-create-output.js could crash with RangeError when
percent > 100 because repeat() received a negative count. Fixed by
clamping filled to [0, width].

New tests:
- progressBar edge cases: 0%, 100%, and >100% confidence
- Empty patterns/instincts arrays
- post-edit-format: null tool_input, missing file_path, prettier failure
- setup-package-manager: --detect output completeness, current marker

Affaan Mustafa · 2026-02-13 02:01:57 -08:00

5398ac793d

fix: clamp suggest-compact counter overflow, add 9 boundary tests

Counter file could contain huge values (e.g. 999999999999) that pass
Number.isFinite() but cause unbounded growth. Added range clamp to
reject values outside [1, 1000000].

New tests cover:
- Counter overflow reset (huge number, negative number)
- COMPACT_THRESHOLD zero fallback
- session-end empty sections (no tools/files omits headers)
- session-end slice boundaries (10 messages, 20 tools, 30 files)
- post-edit-console-warn 5-match limit
- post-edit-console-warn ignores console.warn/error/debug

Affaan Mustafa · 2026-02-13 01:59:25 -08:00

0e0319a1c2

fix: greedy regex in validate-commands captures all refs per line, add 18 tests

The command cross-reference regex /^.*`\/(...)`.*$/gm only captured the
LAST command ref per line due to greedy .* consuming earlier refs.
Replaced with line-by-line processing using non-anchored regex to
capture ALL command references.

New tests:
- 4 validate-commands multi-ref-per-line tests (regression)
- 8 evaluate-session threshold boundary tests (new file)
- 6 session-aliases edge case tests (cleanup, rename, path matching)

Affaan Mustafa · 2026-02-13 01:52:30 -08:00

c1919bb879

fix: sync .opencode/ package version to 1.4.1

The OpenCode sub-package had stale 1.0.0 versions in package.json,
index.ts VERSION export, and package-lock.json while the main package
is at 1.4.1. Updated all three to match.

Affaan Mustafa · 2026-02-13 01:49:39 -08:00

6dcb5daa5c

fix: calendar-accurate date validation in parseSessionFilename, add 22 tests

- Fix parseSessionFilename to reject impossible dates (Feb 31, Apr 31,
  Feb 29 non-leap) using Date constructor month/day roundtrip check
- Add 6 session-manager tests for calendar date validation edge cases
- Add 3 session-manager tests for code blocks/special chars in getSessionStats
- Add 10 package-manager tests for PM-specific command formats (getRunCommand
  and getExecCommand for pnpm, yarn, bun, npm)
- Add 3 integration tests for session-end transcript parsing (mixed JSONL
  formats, malformed lines, nested user messages)

Affaan Mustafa · 2026-02-13 01:42:56 -08:00

e96b522af0

test: add 7 package-manager priority and source detection tests

- Test valid project-config detection (.claude/package-manager.json)
- Test priority order: project-config > package.json > lock-file
- Test package.json > lock-file priority
- Test default fallback to npm
- Test setPreferredPackageManager success case
- Test getCommandPattern for test and build actions

Affaan Mustafa · 2026-02-13 01:38:29 -08:00

34edb59e19

fix: box alignment in test runner, update metadata counts, add 18 tests

- Fix run-all.js box alignment (hardcoded spaces 1 char short, now using dynamic padEnd)
- Update .opencode/index.ts metadata (12→13 agents, 24→31 commands, 16→37 skills)
- Add commandExists edge case tests (empty, spaces, path separators, metacharacters)
- Add findFiles edge case tests (? wildcard, mtime sorting, maxAge filtering)
- Add ensureDir race condition and return value tests
- Add runCommand output trimming and failure tests
- Add pre-compact session annotation and compaction log timestamp tests
- Add check-console-log invalid JSON handling test
- Add replaceInFile capture group test
- Add readStdinJson Promise type check

Affaan Mustafa · 2026-02-13 01:36:42 -08:00

37309d47b7

fix: typecheck hook false positives, add 11 session-manager tests

- Fix post-edit-typecheck.js error filtering: use relative/absolute path
  matching instead of basename, preventing false positives when multiple
  files share the same name (e.g., src/utils.ts vs tests/utils.ts)
- Add writeSessionContent tests (create, overwrite, invalid path)
- Add appendSessionContent test (append to existing file)
- Add deleteSession tests (delete existing, non-existent)
- Add sessionExists tests (file, non-existent, directory)
- Add getSessionStats empty content edge case
- Add post-edit-typecheck stdout passthrough test
- Total: 391 → 402 tests, all passing

Affaan Mustafa · 2026-02-13 01:28:59 -08:00

3f651b7c3c

fix: include .md files in instinct-cli glob (completes #216 )

The observer agent creates instinct files as .md with YAML frontmatter,
but load_all_instincts() only globbed *.yaml and *.yml. Add *.md to the
glob so instinct-cli status discovers all instinct files.

Affaan Mustafa · 2026-02-13 01:26:37 -08:00

e9343c844b

fix: add missing ReplaceInFileOptions to utils.d.ts type declaration

The replaceInFile function in utils.js accepts an optional `options`
parameter with `{ all?: boolean }` for replacing all occurrences, but
the .d.ts type declaration was missing this parameter entirely.

Affaan Mustafa · 2026-02-13 01:24:34 -08:00

7b94b51269

fix: grepFile global regex lastIndex bug, add 12 tests

Fix grepFile() silently skipping matches when called with /g flag regex.
The global flag makes .test() stateful, causing alternating match/miss
on consecutive matching lines. Strip g flag since per-line testing
doesn't need global state.

Add first-ever tests for evaluate-session.js (5 tests: short session,
long session, missing transcript, malformed stdin, env var fallback)
and suggest-compact.js (5 tests: counter increment, threshold trigger,
periodic suggestions, below-threshold silence, invalid threshold).

Affaan Mustafa · 2026-02-13 01:18:07 -08:00

6f95dbe7ba

chore: add dist, __pycache__, and tasks to .gitignore

Prevents accidental commits of build output, Python bytecode
cache, and Claude Code team task files.

Affaan Mustafa · 2026-02-13 01:11:37 -08:00

02120fbf5f

test: add tsconfig depth limit and cleanupAliases exception tests

- post-edit-typecheck: verify 25-level-deep directory completes without
  hanging (tests the max depth=20 walk-up guard)
- cleanupAliases: document behavior when sessionExists callback throws
  (propagates to caller, which is acceptable)

Affaan Mustafa · 2026-02-13 01:10:30 -08:00

a4848da38b

fix: instinct-cli glob and evolve --generate (fixes #216 , #217 )

- Load both .yaml and .yml files in load_all_instincts() (#216)
  The *.yaml-only glob missed .yml files, causing 'No instincts found'
- Implement evolve --generate to create skill/command/agent files (#217)
  Previously printed a stub message. Now generates SKILL.md, command .md,
  and agent .md files from the clustering analysis into ~/.claude/homunculus/evolved/

Affaan Mustafa · 2026-02-13 01:09:16 -08:00

307ee05b2d

test: add coverage for Claude Code JSONL format and assistant tool blocks

Tests the new transcript parsing from PR #215:
- entry.message.content format (string and array content)
- tool_use blocks nested in assistant message content arrays
- Verifies file paths and tool names extracted from both formats

Affaan Mustafa · 2026-02-13 01:07:23 -08:00

c1b6e0bf11

fix: add missing validation in renameAlias, add 6 tests

renameAlias was missing length (>128), reserved name, and empty string
validation that setAlias enforced. This inconsistency allowed renaming
aliases to reserved names like 'list' or 'delete'.

Also adds tests for:
- renameAlias empty string, reserved name, and length limit
- validate-skills whitespace-only SKILL.md rejection
- validate-rules whitespace-only file and recursive subdirectory scan

Affaan Mustafa · 2026-02-13 01:05:59 -08:00

654731f232

docs(zh-CN): sync Chinese docs with latest upstream changes (#202 )

* docs(zh-CN): sync Chinese docs with latest upstream changes

* docs: improve Chinese translation consistency in go-test.md

* docs(zh-CN): update image paths to use shared assets directory

- Update image references from ./assets/ to ../../assets/
- Remove zh-CN/assets directory to use shared assets

---------

Co-authored-by: neo <neo.dowithless@gmail.com>

zdoc.app · 2026-02-13 01:04:58 -08:00

95f63c3cb0

docs(opencode): clarify OpenCode-specific usage (#214 )

* docs(opencode): clarify OpenCode-specific usage

Signed-off-by: Siddhi Khandelwal <siddhi.200727@gmail.com>

* docs(opencode): close bash code fence in CLI example

Signed-off-by: Siddhi Khandelwal <siddhi.200727@gmail.com>

---------

Signed-off-by: Siddhi Khandelwal <siddhi.200727@gmail.com>

Siddhi Khandelwal · 2026-02-13 01:04:36 -08:00

49aee612fb

fix: Windows compatibility for hook scripts (execFileSync + tmux) (#215 )

* fix: Windows compatibility for hook scripts

- post-edit-format.js: add `shell: process.platform === 'win32'` to
  execFileSync options so npx.cmd is resolved via cmd.exe on Windows
- post-edit-typecheck.js: same fix for tsc invocation via npx
- hooks.json: skip tmux-dependent hooks on Windows where tmux is
  unavailable (dev-server blocker and long-running command reminder)

On Windows, execFileSync('npx', ...) without shell:true fails with
ENOENT because Node.js cannot directly execute .cmd files. These
hooks silently fail on all Windows installations.

The tmux hooks unconditionally block dev server commands (exit 2) or
warn about tmux on Windows where tmux is not available.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: parse Claude Code JSONL transcript format correctly

The session-end hook expected user messages at entry.content, but
Claude Code's actual JSONL format nests them at entry.message.content.
This caused all session files to be blank templates (0 user messages
despite 136+ actual entries).

- Check entry.message?.content in addition to entry.content
- Extract tool_use blocks from assistant message.content arrays

Verified with Claude Code v2.1.41 JSONL transcripts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: ddungan <sckim@mococo.co.kr>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

dungan · 2026-02-13 01:04:27 -08:00

4843a06b3a

chore: sync agentshield stats to 102 rules, 912 tests

Affaan Mustafa · 2026-02-12 17:34:23 -08:00

1823b441a9

fix: use valid model name in colon-in-values frontmatter test

The test was using 'claude-sonnet-4-5-20250929' which isn't in VALID_MODELS
(haiku/sonnet/opus). Use 'sonnet' with a description field containing
colons to properly test colon handling in frontmatter values.

Affaan Mustafa · 2026-02-12 17:33:17 -08:00

39280e251b

fix: add input validation, date range checks, and security hardening

- validate-agents.js: reject invalid model names in agent frontmatter
- package-manager.js: validate script/binary names against shell injection
- session-manager.js: reject impossible month/day values in filenames
- utils.js: support options.all for replaceInFile string patterns
- strategic-compact/SKILL.md: fix hook matcher syntax and script reference
- install.sh: warn when overwriting existing rule customizations
- Add 24 new tests covering all validation and edge cases

Affaan Mustafa · 2026-02-12 17:32:04 -08:00

926eba97c5

test: add 6 tests for command validation and session content verification

- validate-commands: creates: line skipping, valid cross-refs, unclosed
  code blocks, valid workflow diagrams
- session-end: backtick escaping in session files, tools/files in output

Affaan Mustafa · 2026-02-12 17:15:21 -08:00

35aed05903

fix: use execFileSync with input option for Windows-compatible stdin tests

Windows cmd.exe treats single quotes literally, so `echo '...' | node -e '...'`
fails. Switched to execFileSync with the `input` option to pipe stdin data
directly without shell quoting issues.

Affaan Mustafa · 2026-02-12 17:14:03 -08:00

c0c54d0dae

fix: add missing clickhouse-io skill to directory listing

Affaan Mustafa · 2026-02-12 17:13:59 -08:00

8248310181

fix: add 7 missing commands to README, remove phantom /security entry

Added: /python-review, /multi-plan, /multi-execute, /multi-backend,
/multi-frontend, /multi-workflow, /pm2, /sessions
Removed: /security (no matching command file; use security-review skill)
Updated count: 24 → 31 commands

Affaan Mustafa · 2026-02-12 17:13:05 -08:00

40a68b323a

test: add regression tests for empty frontmatter field rejection

Add 2 tests verifying validate-agents correctly rejects agents with
empty model and empty tools values in YAML frontmatter.

Affaan Mustafa · 2026-02-12 16:58:27 -08:00

e5f1c58c11

chore: update AgentShield stats to 96 rules, 876 tests

Affaan Mustafa · 2026-02-12 16:58:02 -08:00

f64a61bc94

fix: correct stale counts and broken paths across docs

- .cursor/README.md: skills 30→37, commands ~28→31
- .opencode/MIGRATION.md: fix rules paths (rules/ → rules/common/)
- README.zh-CN.md: fix agent/skill/command counts
- docs/ja-JP/README.md: fix agent/skill/command counts

Affaan Mustafa · 2026-02-12 16:55:49 -08:00

cb4378a0f6

fix: box() off-by-one alignment, add 5 tests for readStdinJson and box alignment

- skill-create-output.js: fix top border being 1 char narrower than
  middle/bottom lines (width - title - 5 → width - title - 4)
- Add box alignment regression test verifying all lines have equal width
- Add 4 readStdinJson tests via subprocess (valid JSON, invalid JSON,
  empty stdin, nested objects) — last untested exported utility function
- All 338 tests passing

Affaan Mustafa · 2026-02-12 16:53:06 -08:00

5107b3669f

chore: update AgentShield stats to 91 rules, 851 tests

Affaan Mustafa · 2026-02-12 16:52:12 -08:00

21c0f281b4

fix: remove unused imports in test files (ESLint)

- validators.test.js: remove unused execSync (only execFileSync used)
- skill-create-output.test.js: remove unused path module

Affaan Mustafa · 2026-02-12 16:51:40 -08:00

64796f99be

Merge pull request #208 from eltociear/add-ja-doc

docs: add Japanese documents

Affaan Mustafa · 2026-02-12 16:48:08 -08:00

a74d708f7f

Merge pull request #210 from Warshoow/docs/token-optimization-guide

docs: add token optimization guide

Affaan Mustafa · 2026-02-12 16:48:01 -08:00

db52081438

chore: update AgentShield stats to 86 rules, 825 tests

Affaan Mustafa · 2026-02-12 16:47:03 -08:00

e8f1250573

fix: add word boundary to dev server hook regex, fix box() crash, add 27 tests

- hooks.json: add \b word boundary anchors to dev server blocking regex
  to prevent false positives matching "npm run develop", "npm run devtools" etc.
- skill-create-output.js: guard box() horizontal repeat with Math.max(0, ...)
  to prevent RangeError when title exceeds container width
- Add 13 tests for setup-package-manager.js CLI argument parsing
- Add 14 tests for skill-create-output.js SkillCreateOutput class
- All 333 tests passing

Affaan Mustafa · 2026-02-12 16:46:06 -08:00

924bac4ddf

fix: set USERPROFILE in tests for Windows os.homedir() compatibility

On Windows, os.homedir() uses USERPROFILE env var instead of HOME.
Tests that override HOME to a temp dir must also set USERPROFILE for
the session-manager, session-aliases, and session-start hook tests
to find files in the correct directory.

Affaan Mustafa · 2026-02-12 16:41:58 -08:00

dc9aefbee1

chore: update AgentShield stats to 792 tests, 84 rules

Affaan Mustafa · 2026-02-12 16:41:39 -08:00

40b354a202

fix: capture stderr in typecheck hook, add 13 tests for session-end and utils

- post-edit-typecheck.js: capture both stdout and stderr from tsc
- hooks.test.js: 7 extractSessionSummary tests (JSONL parsing, array content,
  malformed lines, empty transcript, long message truncation, env var fallback)
- utils.test.js: 6 tests (replaceInFile g-flag behavior, string replace,
  capture groups, writeFile overwrite, unicode content)

Total test count: 294 → 307

Affaan Mustafa · 2026-02-12 16:31:07 -08:00

b1b28f2f92

test: add 33 edge case tests for session-manager, session-aliases, and hooks

- session-manager: CRLF handling, empty sections, multi-heading title, context
  extraction, notes/context detection, MB file size, uppercase ID rejection
- session-aliases: missing timestamps sort, title search, createdAt preservation,
  whitespace-only path rejection, empty string title behavior
- hooks: session-start isolated HOME, template vs real session injection,
  learned skills count, check-console-log passthrough

Total test count: 261 → 294

Affaan Mustafa · 2026-02-12 16:26:57 -08:00

e9f0f1334f

test: add cross-reference validation tests for validate-commands

- Add runValidatorWithDirs() helper for multi-constant overrides
- Test broken command references (e.g., /nonexistent-cmd)
- Test broken agent path references (e.g., agents/fake-agent.md)
- Test fenced code block exclusion (refs inside ``` are skipped)
- Test broken workflow agent references (e.g., planner -> ghost-agent)
- Total tests: 261 → 287 (+26)

Affaan Mustafa · 2026-02-12 16:26:24 -08:00

6fa3bfe71d

chore: update AgentShield stats to 767 tests, 76 rules

Affaan Mustafa · 2026-02-12 16:26:22 -08:00

8cf472a5f4

fix: add event type enum to hooks schema and avoid shared RegExp state

- hooks.schema.json: add enum constraint for hook event types
  (PreToolUse, PostToolUse, PreCompact, SessionStart, SessionEnd,
  Stop, Notification, SubagentStop) — enables IDE autocompletion
  and compile-time validation
- utils.js countInFile: always create fresh RegExp to avoid shared
  lastIndex state when reusing global regex instances
- README: update AgentShield stats (751 tests, 73 rules)

Affaan Mustafa · 2026-02-12 16:24:48 -08:00

7ec5fc3a52

fix: broken cross-references, version sync, and enhanced command validator

- Fix /build-and-fix → /build-fix in tdd.md, plan.md (+ cursor, zh-CN)
- Fix non-existent explorer agent → planner in orchestrate.md (+ cursor, zh-CN, zh-TW)
- Fix /python-test → /tdd in python-review.md (+ cursor, zh-CN)
- Sync package.json version from 1.0.0 to 1.4.1 to match plugin.json
- Enhance validate-commands.js with cross-reference checking:
  command refs, agent path refs, skill dir refs, workflow diagrams
- Strip fenced code blocks before scanning to avoid false positives
- Skip hypothetical "Creates:" lines in evolve.md examples
- Add 46 new tests (suggest-compact, session-manager, utils, hooks)

Affaan Mustafa · 2026-02-12 16:19:04 -08:00

bc0520c6c1

212 Commits